ID. Date of interview 
date 42/92/20 


ID. — Time interview started 
start 45:19:24 


ID.end Completion date of interview 
Date 42/02/20 


ID.end Time interview ended 
15:23:57 


ID. Duration of interview 
time 4.55 


new Case 


ICO consultation on the draft right of access 
guidance 


Q1 


Does the draft guidance cover the relevant issues about the right of access? 
© Yes 
©) No 

©) Unsure / don't know 

If no or unsure/don’t know, what other issues would you like to be covered in it? 


Q2 


Does the draft guidance contain the right level of detail? 


© Yes 
©) No 

©) Unsure / don't know 

If no or unsure/don't know, in what areas should there be more detail within the draft 
guidance? 


Q3 


Does the draft guidance contain enough examples? 
-) Yes 


© No 


©) Unsure / don't know 
If no or unsure/don'’t know, please provide any examples that think should be included in 
the draft guidance. 


It would be helpful for an example about what a third-party portal request would look like to be provided, 
for example a letting agency reference request. 


Q4 


We have found that data protection professionals often struggle with applying and 
defining ‘manifestly 


unfounded or excessive’ subject access requests. We would like to include a wide 
range of examples 

from a variety of sectors to help you. Please provide some examples of manifestly 
unfounded and excessive 

requests below (if applicable). 


Mr X has requested his Social Work files of his child and grandchild in 2015. He 
received the information he was entitled to at the time. In 2016, he complained that 
the information he expected to see was not there. He was advised to contact the 
ICO. Mr X also asks about a voicemail, which we have advised we no longer hold. Mr 
X asks for copies of the voicemail and documents from his records on a monthly 
basis. Our unacceptable actions policy has been implemented in relation to the 
excessive volume of complaints received from Mr X. 


Q5 


Q6 


Q7 


On a scale of 1-5 how useful is the draft guidance? 


1-Notatall 2-—Slightly | Moderately 4-Very 5-Extremely 
useful useful useful useful useful 


Why have you given this score? 


The guidance provides comprehensive information broken into appropriate sections 
which helps to confirm our understanding of how Subject Access Requests should be 
handled. The information relating to third party portal requests and no expectation 
to produce FOISA/EIR refusal notices provides us with clarity in these areas. The 
advice around consideration of risk assessments was also particularly helpful. We 
have some concerns regarding the guidance in relation to compliance times and 
specifically guidance on the choice to adopt the 28 day option or 1 month unless the 
corresponding date falls on a weekend or public holiday option. Whilst we appreciate 
the additional time processing (especially over Christmas), we feel that this could 


cause potential confusion for customers if a consistent approach is not taken by all 
organisations. 


To what extent do you agree that the draft guidance is clear and easy to understand? 


Strongly Neither agree Strongly 
disagree Disagree nor disagree Agree agree 


© 


Q8 


Q9 


Please provide any further comments or suggestions you may have about the draft 
guidance. 


Given the increase in requests being received from care experienced individuals and 
the large volume of files and complexity often involved, it would be helpful if this 
could be acknowledged within the guidance. Some information around how such 
requests could be handled would also be welcomed e.g. partial releases of requests 
as and when available at the agreement of the applicant. Further clarification 
around complex requests would also be beneficial, particularly in relation to the 
statement - “Applying an exemption that involves large volumes of particularly 
sensitive information” as a reason why a request may be considered complex. This 
statement may be misinterpreted and further information as to why this leads to 
complexity would provide clarity. “Applying an exemption” is wide ranging and could 
include quoting an exemption in a response letter or complex redaction of Social 
Work records. It is helpful to have in the guidance that applying an exemption that 
involves a large amount of sensitive information may lead to a request being 
complex, and clear that this encompasses all of the activities required to properly 
apply exemptions. 


Are you answering as: 

C) An individual acting in a private capacity (eg someone providing their views as a member of the public) 
(`) An individual acting in a professional capacity 

© On behalf of an organisation 

€ ) Other 

Please specify the name of your organisation: 

Aberdeen City Council 


What sector are you from: 


Public 


Q10 How did you find out about this survey? 
©) ICO Twitter account 
(C) ICO Facebook account 
©) ICO LinkedIn account 
C) ICO website 
\_) ICO newsletter 
(_) ICO staff member 
©) Colleague 
(`) Personal/work Twitter account 
( _) Personal/work Facebook account 
() Personal/work LinkedIn account 
“` Other 
If other please specify: 


